|
|
Botnet worm hits iPhone users
Author: Gareth HalfacreePublished: 24th November 2009
iPhone owners with jailbroken handsets should ensure that the root password is changed and the SSH service disabled.
You may remember the reports of a Dutch cracker who was holding jailbroken iPhones which still had the default SSH password - 'alpine' - to ransom, demanding payments of €5 to secure the device against illegitimate use. Sadly, someone with a far nastier mind has caught on to the idea - interestingly, with the initial reports coming once again from Dutch users.
As reported by Chester Wisniewski at anti-virus vendor Sophos, reports from Dutch ISPs indicate that a suspicious level of traffic was coming from iPhone users - in particular scans aimed at port 22, the TCP port used by the Secure SHell (SSH) service which allows users to log on to a jailbroken iPhone.
Unlike the original attack, this version of the worm is both more sophisticated and more malevolent - joining infected iPhone and iPod Touch handsets to a botnet via a command and control server located in Lithuania and changing the default SSH password to an obscenity to make repairing the damage done that much harder. Before handing control of the iPhone over to the central botnet server, it uploads personal information garnered from the handset - including two-factor authentication SMS mTANs used by online banks - before attempting to scan for other insecure iPhones it can infect. Indeed, the amount of traffic generated is so great that one of the major tell-tales for infection is a drastically reduced battery life when the iPhone is connected to a WiFi network.
So far there appears to be no easy way to remove the worm once infection has taken place, with Wisniewski recommending that users with jailbroken handsets restore the default, locked-down version of the iPhone's operating system via iTunes in order to protect themselves. Tech blog Redmond Pie has alternative advice for those who are not yet infected: simply change the SSH password from the default value, or disable the SSH service altogether once the jailbreak has taken place.
Are you surprised to see a worm of such sophistication hit the iPhone, or has its popularity combined with always-on Internet connectivity made it an obvious target for ne'er-do-wells? Share your thoughts over in the forums.
Related
Comments (20)- Site Links:
- About
- Email Editor
- Newsletter
- Privacy
- RSS
- Score Guide
- Our Other Websites:
- Auto Express
- Channel Pro
- Computer Buyer
- Computer Shopper
- Den of Geek
All content © bit-tech.net 2000-2010
© Copyright Dennis Publishing Limited licensed by Felden
No, it's user stupidity. If you leave SSH with default password you should get punished by losing all your data and money from your online bank. And Apple users are well known for being not-the-smartest ones, so they're an obvious target.
When you root an android phone (well, maybe not all of them, but it works like this for mine), it sets the SSH password to the phone's IMEI number. Pretty sensible, because it's easy to look up if you own the phone, but harder to guess than 'alpine'!
spoken like a true C.E.O. ;p
Hehe so true.
[Edit]My iTouch is jailbroken and root pw, well, something else than default.[/Edit]
BOTNET!
"There's an app for that"
I havent seen one heading for this article on the internet that says jailbroken iphones in the headline"
I'd say around 65% of the people with a jailbroken iphone would know what SSH was, the rest well.
i know alot of people with jailbroken iphones and they dont know anything about how it works, they got someone to jailbreak it for them.
QFT. Is it really hard to change a password? jeeze, people whoare like "remove the jailbreak" need a good schooling.
I guess the difference with the iPhone is that you don't need to explicitly turn SSH on, as soon as its jailbroken its there with the default password. I don't know.
It's still pretty dumb not to change from default passwords.
lol